> ## Documentation Index > Fetch the complete documentation index at: https://docs.kombify.io/llms.txt > Use this file to discover all available pages before exploring further. # Report kombify Guard host security and backup observations > The Guard's posture channel. A full report carries what the Guard observed through the privileged executor's read-only StackKits operations: the `stackkit.host-security-evidence/v1` document of `stackkit host security verify` and the receipt states of `stackkit backup status`. A check-in (`check_in: true`) carries nothing and only asks whether a fresh observation was requested. The identity is the authenticated worker's; the control plane recomputes the verdict from the controls, judges time by its own clock, and records a document it cannot read (unknown schema version, unknown control or state, bad freshness window) as `evidence_rejected`, which leaves no earlier pass standing. A StackKits release without the command is reported as `unsupported` and shows as `security.state: unknown` with `reason_code: stackkit_cli_unsupported`. The answer is the directive: `verify_requested` and the routine cadence. Editions without posture answer `state: disabled`. ## OpenAPI ````yaml /techstack/reference/api/openapi.yaml post /api/v1/workers/{id}/posture openapi: 3.1.0 info: title: kombify-TechStack API description: > REST API for kombify-TechStack -- the hybrid cloud control plane for homelabs. kombify-TechStack manages infrastructure through a spec-driven architecture: validate YAML specs via CUE, generate OpenTofu configurations, and manage nodes through a gRPC agent protocol. ## Authentication Authenticated endpoints accept an OIDC/JWKS bearer token or an API key where documented. Self-hosted TechStack defaults to Pocket ID as identity provider. SaaS routes enter through the edge with Auth0 as the platform identity provider. PocketBase session exchange remains legacy migration compatibility only. ## Response Format **Success:** `{ "data": , "meta": { "total": int, "page": int, "per_page": int } }` **Error:** `{ "error": { "code": "", "message": "...", "details": } }` ## Pagination List endpoints accept `page` (default: 1) and `per_page` (default: 20, max: 100) query parameters. version: 1.0.0 contact: name: kombify url: https://kombify.io license: name: Apache-2.0 AND GPL-3.0 url: https://github.com/KombiverseLabs/kombify-TechStack/blob/main/LICENSE servers: - url: https://api.kombify.io/v1/techstack description: >- Production canonical (via Cloudflare edge gateway, strip-prefix). Clients MUST use this projection. The Gateway strips /v1/techstack and re-adds /api/v1 at the origin, so it resolves the /api/v1/* paths below cleanly. - url: http://localhost:5260 description: Local development - url: https://techstack.kombify.io description: Production (direct, no Gateway prefix) - url: https://api.kombify.io/v1/orchestrator description: >- Legacy StackKit-Orchestrator projection of the same origin. RETAINED for backward compatibility with existing consumers only. Do NOT use for mobile or new clients: combined with the /api/v1/* paths it double-resolves (yielding /v1/orchestrator/api/v1/...). Prefer /v1/techstack. security: - bearerAuth: [] tags: - name: Health description: Health checks and service info (no auth required) - name: Instance description: Local instance identity and enrollment metadata - name: Stacks description: Stack lifecycle management (create, provision, deploy, destroy) - name: Stacks - Specs description: Access persisted specification chain (intent, requirements, unified) - name: Stacks - Import/Export description: Import and export StackKits stack-spec.yaml configurations - name: Stacks - Drift description: Infrastructure drift detection and resolution - name: Unifier description: Spec validation, analysis, unification, and IaC generation pipeline - name: StackKits description: Infrastructure template catalog - name: Add-ons description: Add-on detection and registry - name: Workers description: Worker node registration and management - name: Servers description: Canonical server lifecycle, connection, and health state - name: Inventory description: >- Owner-scoped sanitized server and service read models for UI, API, and MCP clients - name: Pre-Checks description: Pre-deployment hardware and software validation - name: Agents description: Connected gRPC agent management and commands - name: Jobs description: Background job monitoring and SSE streaming - name: Discovery description: Network device discovery and SSH testing - name: Features description: Feature flags (read-only; managed centrally via the kombify Admin API) - name: Monthly Runtime description: Provider-free user API for subscription-backed stack runtime control - name: Runtime description: Recent runtime/deploy logs (job/deploy progress + container tail) - name: Wallet description: >- Redacted recovery-item wallet with biometric/platform-reauth-gated reveal. List responses strip secret/totp; reveal requires a fresh trusted-reauth HMAC proof (5-minute window) and is audited server-side. - name: Trust description: Pairing tokens for worker enrollment - name: Client Binding description: >- Short-lived HTTPS pairing for a second client and normal OIDC account handoff - name: Tunnel description: Cloudflare tunnel management for NAT traversal - name: Backups description: Database backup management (admin only) - name: Auth description: Authentication mode and SSO configuration - name: Metrics description: Prometheus-compatible instance metrics for admin/infra scrapers - name: Internal description: >- Internal SaaS-only APIs, including servicecall-protected executor contracts paths: /api/v1/workers/{id}/posture: post: tags: - Workers summary: Report kombify Guard host security and backup observations description: >- The Guard's posture channel. A full report carries what the Guard observed through the privileged executor's read-only StackKits operations: the `stackkit.host-security-evidence/v1` document of `stackkit host security verify` and the receipt states of `stackkit backup status`. A check-in (`check_in: true`) carries nothing and only asks whether a fresh observation was requested. The identity is the authenticated worker's; the control plane recomputes the verdict from the controls, judges time by its own clock, and records a document it cannot read (unknown schema version, unknown control or state, bad freshness window) as `evidence_rejected`, which leaves no earlier pass standing. A StackKits release without the command is reported as `unsupported` and shows as `security.state: unknown` with `reason_code: stackkit_cli_unsupported`. The answer is the directive: `verify_requested` and the routine cadence. Editions without posture answer `state: disabled`. operationId: reportWorkerPosture parameters: - $ref: '#/components/parameters/resourceId' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/GuardPostureReport' responses: '200': description: The directive for the next observation content: application/json: schema: type: object properties: data: type: object properties: posture: $ref: '#/components/schemas/GuardPostureDirective' '400': $ref: '#/components/responses/BadRequest' '401': description: Access token or proof not accepted '503': $ref: '#/components/responses/ServiceUnavailable' security: - runtimeAgentAuth: [] components: parameters: resourceId: name: id in: path required: true description: Resource ID schema: type: string schemas: GuardPostureReport: type: object additionalProperties: false required: - schema_version - source_epoch - source_sequence - observed_at properties: schema_version: type: string enum: - kombify.guard-posture/v1 check_in: type: boolean description: A check-in carries no observation. source_epoch: type: string maxLength: 64 source_sequence: type: integer format: int64 minimum: 0 observed_at: type: string format: date-time guard_version: type: string maxLength: 64 guard_signed: type: boolean verify_request_id: type: string pattern: ^[A-Za-z0-9_-]{1,64}$ description: >- The `verify_request_id` of the directive being answered. Set only on a report whose observation the Guard started after it received that directive; a routine observation carries none. security: type: object required: - status properties: status: type: string enum: - observed - unsupported - unavailable - failed reason_code: type: string pattern: ^[a-z0-9_]{1,64}$ evidence: type: object description: >- The stackkit.host-security-evidence/v1 document (schemas/stackkit-host-security-evidence-v1.schema.json), at most 256 KiB. backup: type: object required: - status properties: status: type: string enum: - observed - unsupported - unavailable - failed reason_code: type: string pattern: ^[a-z0-9_]{1,64}$ ready: type: boolean snapshot_state: type: string enum: - recorded - unverified - clock-skew last_snapshot_at: type: string format: date-time restore_state: type: string enum: - recorded - unverified - clock-skew last_restore_at: type: string format: date-time GuardPostureDirective: type: object properties: state: type: string enum: - disabled description: Present only where posture is off. verify_requested: type: boolean verify_request_id: type: string description: >- Opaque token of the pending request. The Guard echoes it as `verify_request_id` in the report of the fresh observation it starts for the request; only that report answers it. A Guard that does not echo it keeps working, and its second report without the token answers the request. verify_interval_seconds: type: integer minimum: 0 ErrorResponse: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string enum: - INTERNAL_ERROR - NOT_FOUND - BAD_REQUEST - UNAUTHORIZED - FORBIDDEN - CONFLICT - VALIDATION_ERROR - RATE_LIMITED - SERVICE_UNAVAILABLE - METHOD_NOT_ALLOWED message: type: string details: description: Additional error context (validation errors, etc.) responses: BadRequest: description: Bad request content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ServiceUnavailable: description: Required control-plane persistence or dependency is unavailable content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- OIDC/JWKS bearer token. Self-hosted defaults to Pocket ID; SaaS uses Auth0 through the edge. PocketBase JWT is legacy migration compatibility only. runtimeAgentAuth: type: http scheme: bearer bearerFormat: TechStack-Runtime-Agent description: >- Runtime-agent credential bound to the exact tenant, placement, server, and worker identity. Signed, opaque, and explicit legacy compatibility tokens are validated fail-closed by the worker runtime. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.